On 5/21/07, Łukasz Pilorz <lukasz@pilorz.net> wrote:
> I think this encoding bypass may have some impact on applications> which convert data from Unicode/UTF to other encodings. A naive> example:> http://lukasz.pilorz.net/testy/full_width_utf/index.phps>> But I don't suggest this was the main problem, I have probably missed> something too.

Your POC works for me, the PHP iconv code converts the UTF-8 byte
sequence 0xef 0xbc 0x9C to ASCII '<'. Looks like PHP applications
may be at risk.

The java CharsetDecoder class does not. (I don't think this will be
JRE specific, but I tested the IBM JRE...).